Interesting point. In this case, Rails would create a session and store the sid in `:session_id`, then the user would overwrite it (since the creation would take place before such an assignment).
For the cookie_store this should be harmless, since it's not looked up by this key. Other session stores store the session data by the sid, but it's not within the session data. I suppose Rails could use `:_session_id`, but you'd still have the same issue.

So, it seems that using `session[:session_id]` to get the sid is cookie_store specific.
I'd be all for a unified way to get the current session's id from the session object, as you suggested.
However, even if this were done, it would still have to be stored within the session data for cookie_store.